Third-party AI agents are already transacting on your site. As of November 4, 2026 there is a free, widely deployed way to count them — and a measurement-first sequence for deciding what to fix, expose, or block.
Last Updated: November 6, 2026
Other people's agents are now inbound traffic against your funnel. Microsoft Clarity shipped an Agent Activity dashboard that segments agent sessions for free, and its own data shows checkout events recorded in 25.21% of agentic sessions versus 14.65% of human ones. Measure first: segment agent sessions, find the exact step where automated journeys stall, then decide per step whether to fix the DOM, publish a structured path, or deliberately block. Do not publish an MCP endpoint or a product feed before you know which step is failing — you will have shipped an unversioned public API to solve a problem you never diagnosed.
Three announcements in 48 hours, and only one of them is about measurement
On November 4, 2026 Microsoft Clarity made its agent analytics generally available. The Agent Activity dashboard shows how agentic traffic changes over time, which agents arrive, and what they do once they land — searches, form submissions, logins, downloads, appointment bookings and checkout. Clarity also added simulation assessments that test whether an agent can complete a key task on your site, reporting completion, duration and interaction count, starting with commerce and travel scenarios.
The day after, Sierra acquired Anon, a startup whose entire product was helping agents sign in to websites, navigate portals and fill forms in services that have no API. Anon's founder Daniel Mason wrote that the team raised more than $13M, shipped to hundreds of customers, and completed hundreds of thousands of complex tasks in production. On the same day, Meta acquired Conductor, which lets developers deploy multiple coding agents into parallel workspaces.
Read those together and the shape of the week is clear. The supply of agents driving real browsers is being bought up and industrialised, and in the same 48 hours the first free, mass-deployed way to count those agents on your own property went GA. Until this week most operators were serving a segment of traffic they could neither name nor measure.
What Clarity's 5.2 million sessions actually show
Clarity's October 29 study analysed more than 5.2 million agentic-classified sessions across 230,511 projects between August 13 and September 9, 2026, classifying sessions by detected agentic browser providers across the OpenAI, Google and Anthropic ecosystems. The headline finding is that task-oriented actions are weighted far more heavily in agent sessions: checkout 25.21% against 14.65% for humans, search 7.16% against 4.79%, while outbound clicks dominate human sessions at 26.99% and fall to 14.28% for agents.
That is directionally useful and it is the best public dataset we have. It also needs three caveats that most coverage dropped.
The denominator does not match the headline. Clarity's own table reports 306,621 checkout sessions at 25.21%. Divide those and you get an implied base of about 1.22 million sessions, not 5.2 million. Run the same division on form submissions (241,391 at 19.85%) and appointment bookings (102,401 at 8.42%) and you land within a thousand sessions of the same 1.216 million base every time. PPC Land flagged the same gap. Against the full 5.2 million, checkout would be roughly 5.9%. Use the 25% figure as a statement about sessions where Clarity detected something, not as a conversion rate.
Agentic does not mean autonomous. Clarity states plainly that a session can include a human handoff and that it cannot currently split the agent and human portions, so the recorded events are “not necessarily actions completed autonomously by an agent”. A shopper who asks an agent to find a product and then takes the wheel at payment produces a session that looks like an agent checkout.
Coverage is three vendors wide. Clarity's footnote limits supported detection to Google, OpenAI and Anthropic agent operators. Everything running on Browserbase, Playwright on a VPS, an in-house harness, or a Sierra-style enterprise agent behind a login is invisible to that classifier. Your true agent volume is higher than the dashboard says, and the gap is not uniform across industries.
Reading the agent dashboard as a funnel
The Smart Events table looks like a journey: search, add to cart, checkout. It is not. Clarity says these are non-mutually-exclusive session counts across different websites and industries, and explicitly warns they do not establish sequential funnels or verified task completion. Add to cart at 2.33% sitting below checkout at 25.21% is the tell — those are different sites, not a drop-off.
Why the supply of browser-driving agents just jumped
The technical reason agents are suddenly hitting checkout rather than reading your blog is that browser harnesses got reliable enough to trust with multi-step work. Mason's framing in the Sierra post is the honest version of what changed:
Better models and harnesses have made browser agents far more reliable.
— Daniel Mason, founder of Anon, Sierra blog
Anon's pitch was that roughly 70% of software has no usable API, which is why its product turned login screens into data streams rather than waiting for integrations that were never going to exist. Sierra bought that capability specifically so its long-running agents can carry a loan origination or a prior authorisation through portals that will never ship a public endpoint. Your checkout is on the same list.
The counterweight is identity. Cloudflare's signed agents classification uses Web Bot Auth — HTTP message signatures — so an agent's infrastructure cryptographically proves who it is on every request, with the first cohort including ChatGPT agent, Block's Goose, Browserbase and Anchor Browser. This matters more than it sounds. Signed agents are the only population you can allow, rate-limit or price differently with any confidence. Everything else is user-agent strings and fingerprinting, which is a losing arms race when the agent is driving a real Chrome instance.
The measurement-first sequence
The order matters. Almost every team we see gets this backwards: they read an agentic commerce announcement, commission a feed or an MCP server, and ship it without ever establishing that agents were failing at the step the new surface addresses.
Six steps, in this order
Install Clarity alongside your existing analytics and turn on Agent Activity. Separately, pull edge logs for Web Bot Auth signatures and known agent ASNs. The union of the two is your real agent population; the delta between them is your blind spot.
Same ordered events you already track, split by agent versus human. You are looking for the step where the two curves diverge, not for absolute agent volume.
Nothing substitutes for this. You will see the agent click the wrong element, loop on an address autocomplete, or sit on a challenge page for ninety seconds. Aggregate numbers never tell you which widget broke.
Rendering, semantics, verification, or policy. The cause determines the fix, and three of the four are cheap.
Not per site. A product page can be agent-friendly while your gift card redemption stays human-only.
Clarity's simulations give you a repeatable pre-release check. Treat them as smoke tests, not proof — they run the scenarios Microsoft wrote, not the ones your customers ask for.
Where automated journeys stall
Across browser-agent work, the failure points cluster tightly, and they are rarely where teams expect.
Authentication and MFA. The hardest one, and the reason Anon existed as a company. An agent can hold a session cookie; it cannot read the SMS code. Passkeys make this worse, not better, because the authenticator is bound to a device the agent does not control. Sites that offer magic links accidentally become the most agent-accessible.
Address and payment field widgets. Third-party autocomplete components are the single most common stall we see. The agent types a full address, the widget silently rejects the unselected suggestion, validation fires on blur, and the agent re-types the same string in a loop until the harness times out. Any field whose true value lives in a JS-managed hidden input rather than the visible input is a trap.
Verification interstitials. CAPTCHA and bot-management challenges do exactly what they were built to do. The question is whether you intend them to fire on a signed agent carrying a real customer's intent. Most teams have never made that decision explicitly — the default inherited from their WAF made it for them.
Stock, price and promo logic that only exists in the client. If the final price is assembled by JavaScript after three async calls, an agent reading an early snapshot of the DOM quotes the wrong number to its user, and the purchase fails at confirmation. Clarity's own framing of the problem is an agent that finds the right product but misses the promotion.
Multi-step carts and iframes. Payment iframes, shadow DOM components and virtualised lists all hide state from the accessibility tree the agent reads. Anything that breaks a screen reader breaks an agent, which is the most useful heuristic in this whole area.
Fix the DOM, publish a structured path, or block
Once you know the failing step, there are four real options and they have very different ownership costs. The mistake is picking one for the whole site.
| Option | Best when | What it actually costs you |
|---|---|---|
| Repair the DOM stable IDs, ARIA roles, server-rendered price, no blur-only validation | The stall is rendering or semantics. Almost always the first move. | A sprint of front-end work. No new public surface, no new contract. Also improves accessibility and conventional SEO, so it is the only option that pays for itself if agent volume disappoints. |
| Publish a structured product feed schema.org, merchant feed, or an ACP-style product spec | Agents are finding the wrong price, stock state or variant before they ever reach the cart. | Freshness obligations. A feed that lags your catalogue by six hours generates failed checkouts and refund tickets, which is worse than no feed. |
| Expose an MCP endpoint tools for search, availability, quote, book | You want deterministic agent transactions and are prepared to operate it as a product. | A new, public, effectively unversioned API with no rate-limit precedent, no deprecation path your consumers respect, and an auth model you have to design. See below. |
| Challenge or block signed-agent rules at the edge | The step carries fraud, legal or margin risk: gift cards, limited drops, regulated quotes, account changes. | Invisibility in the surfaces those agents report back to. Blocking is a legitimate decision; blocking by accident, via a WAF default, is not. |
The agentic commerce protocols are worth understanding before you commit. OpenAI and Stripe co-developed and open-sourced the Agentic Commerce Protocol in September 2025 to power Instant Checkout, with merchants paying a fee on completed purchases and keeping their own payments and fulfilment systems. That is a different bet from an MCP endpoint: ACP-style integration puts the transaction inside someone else's surface, while MCP keeps it on your infrastructure and your terms. Plenty of catalogues should do both. Very few should do either before step four of the sequence above. If you want this scoped against your own stack rather than in the abstract, that is the kind of work our integration engagements start with, and the model and protocol coverage page tracks what each vendor actually supports today.
Agent traffic is not free traffic
Vendor posts about the agentic web skip the operating cost. Four things change on your side the moment agent volume becomes material.
Infrastructure. Agent sessions are heavier per unit of revenue than human ones. They retry, they re-read pages to confirm state, and a reasoning loop that re-fetches a product page four times to verify a price is normal behaviour, not a bug. Origin compute, CDN egress and any per-request bot-management or fraud-scoring charges all scale with that.
Fraud surface. Everything that makes a step easy for a legitimate agent makes it easier for an automated attacker. Card testing, loyalty-point draining, promo stacking and scalping all run on exactly the browser infrastructure that legitimate agents use. If you relax a challenge for agents, relax it for cryptographically signed agents with a named operator you can revoke, and nothing else.
Attribution. This one bites quietly. Agent sessions arrive from datacenter IPs with no meaningful referrer, no UTM parameters and no stable client ID across the handoff back to the human. Conventional analytics either filters them as bots or files them under direct traffic, so paid campaigns that genuinely influenced an agent-mediated purchase get credited to nothing. Before you re-plan a channel budget, check how much of your unattributed revenue is actually agent-mediated.
Treating an MCP endpoint as a side project
A public MCP server is a production API with none of the governance a production API usually gets. Tool descriptions become a contract that third-party models depend on; rename a parameter and you silently break every agent integrated against it, with no changelog subscriber list to notify. It is also a new injection surface, because the tool outputs you return are fed straight into someone else's model context.
What to do in the next 30 days
This is a measurement project before it is an engineering project, and the measurement part is nearly free.
Instrument. Clarity on every revenue-bearing template, agent flag plumbed into your own event stream, edge logs retained long enough to join. Establish a baseline agent share before you change anything.
Diagnose. Twenty session recordings of agent journeys, one classified stall per journey, ranked by revenue exposed. Expect two or three causes to account for most of it.
Repair the cheap half. Stable selectors, server-rendered prices, labelled form fields, validation that fires on input rather than only on blur. Audit which of your challenge rules fire on signed agents and decide each one on purpose.
Re-measure, then decide about structured surfaces. If agents now complete the journey, you have saved yourself an API you would have had to own forever. If they still stall at a step that is genuinely not expressible in a UI, that is your business case for a feed or an endpoint.
The honest summary is that agent traffic is real, commercially weighted, growing fast, and still small enough at most sites that the correct response is instrumentation plus a sprint of front-end hygiene — not a platform project. The teams that will regret this quarter are the ones who shipped an unmaintained MCP server in November and the ones who never looked at the dashboard at all. If you want the diagnosis run properly, start here, and our case studies cover how we sequence this kind of work.
Frequently Asked Questions
How do I tell whether AI agents are already visiting my website?
Install Microsoft Clarity and open the Agent Activity dashboard, which is generally available for projects with agentic traffic and free. It identifies which agents arrive and what they do. Supplement it with edge logs: look for Web Bot Auth signatures and datacenter ASNs. Clarity currently detects agents from the OpenAI, Google and Anthropic ecosystems only, so treat its count as a floor rather than a total.
Does the 25% agent checkout statistic mean agents convert better than humans?
No. Clarity reports that a checkout event was recorded in 25.21% of agentic sessions versus 14.65% of human sessions, but these are non-mutually-exclusive event counts across different sites, not a funnel, and the implied base is around 1.22 million sessions rather than the 5.2 million in the headline. Sessions can also include a human handoff, so the event is not proof of an autonomous purchase.
Should I build an MCP endpoint or just make my site easier for agents to use?
Fix the DOM first in almost every case. Stable selectors, server-rendered prices and properly labelled form fields solve most stalls, cost one sprint, and improve accessibility and search at the same time. An MCP endpoint is a public API you must version, authenticate, rate-limit and deprecate responsibly. Build it only when you have evidence of a step that cannot be expressed reliably in a UI.
Is it reasonable to block AI agents from parts of my site?
Yes, and it should be a deliberate per-step decision rather than a WAF default. Gift card redemption, limited-stock drops, account changes and regulated quotes are reasonable places to require a human. The useful lever is Cloudflare signed agents: cryptographic HTTP signatures let you allow a named operator at some steps and challenge everything unsigned, instead of guessing from user-agent strings.
Why does agent traffic break my analytics attribution?
Agent sessions typically originate from cloud browser infrastructure with datacenter IPs, no referrer and no campaign parameters, and the identity may change when the journey hands back to a human. Standard analytics either filters them as bot traffic or buckets them as direct, so campaigns that genuinely influenced the purchase receive no credit. Before reallocating budget, check how much unattributed revenue is agent-mediated.
What does the Sierra acquisition of Anon mean for site owners?
It signals that enterprise agents will increasingly operate your site through a real browser behind a login rather than waiting for an API. Anon built authentication handling, browser infrastructure and an agent harness specifically for services without APIs, and Sierra bought it so its long-running agents can complete multi-system workflows. Expect more authenticated, persistent agent sessions on portals and account areas, not just product pages.
Are Clarity simulations enough to validate agent readiness?
They are a useful smoke test, not a guarantee. Simulations report whether a task completed, how long it took and how many interactions it required, currently across commerce and travel scenarios. They run Microsoft's scenarios against one agent implementation. Your edge cases — regional address formats, promo stacking, MFA, inventory races — still need live session review against real agent traffic.
Research digest
AI Research Briefing
Honest insights on AI agents, Small Language Models, and local RAG. No hype. Only when we have something worth sending.
- No hype, just measurable outcomes
- Read by 2,400+ engineers
- Unsubscribe anytime
